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SUBJECT:  Review  of  DoD  Implementation  of  Electronic  Commerce  in  Contracting 
for  Small  Purchases  (Project  No.  5CA-3002) 


Introduction 

We  are  providing  this  report  for  your  information  and  use.  This  report 
identifies  and  summarizes  issues  related  to  the  implementation  of  electronic 
commerce  within  DoD.  Both  the  DoD  Electronic  Commerce  Office  within  the 
Office  of  the  Deputy  Under  Secretary  of  Defense  (Acquisition  Reform)  and  the 
Defense  Information  Systems  Agency  (DISA)  are  currently  addressing  many  of 
the  issues  identified.  Therefore,  the  purpose  of  this  report  is  to  compile  those 
issues  identified,  to  identify  efforts  being  made  in  those  areas,  and  to  identify 
other  audits  and  reviews  being  performed  on  specific  topics. 


Review  Results 

The  review  identified  a  series  of  issues  involved  in  the  implementation  of 
electronic  commerce  within  DoD.  The  issues  were  identified  during  a  review  of 
the  implementation  of  the  Federal  Acquisition  Computer  Network  (FACNET)  at 
DoD  buying  organizations,  gateways,  network  entry  points  (NEPs),  and 
value-added  networks  (VANs).  FACNET  is  a  Government-wide  electronic 
commerce/electronic  data  interchange  (EC/EDI)  system  architecture  for 
acquisition.  Implementation  of  FACNET  is  a  requirement  of  the  Federal 
Acquisition  Streamlining  Act  of  1994.  See  Enclosure  1  for  glossary  of  terms. 

The  issues  identified  include: 

o  realization  of  the  "single  face  to  industry"  concept, 

o  adequacy  of  the  transmission  of  data  by  the  DoD  FACNET 
infrastructure, 


o  implementation  of  security  controls, 


o  level  of  vendor  participation, 

o  adequacy  of  management  controls  for  FACNET  transactions,  and 

o  adequate  development  of  FACNET  implementation  plans. 

The  Deputy  Under  Secretary  of  Defense  (Acquisition  Reform)  and  DISA  are 
aware  of  the  issues  and  are  implementing  corrective  actions.  The  purpose  of 
this  report  is  to  summarize  the  issues.  In  addition,  the  Office  of  the  Inspector 
General,  DoD,  is  currently  performing  audits  on  the  implementation  of 
FACNET.  Those  audits  will  address  some  of  the  issues  identified  during  this 
review. 


Review  Objectives 

The  overall  objective  was  to  review  the  DoD  implementation  of  electronic 
commerce  for  small  purchases.  The  specific  objectives  were  to  identify 
potential  impediments  to  timely  and  effective  implementation  of  EC/EDI  and  to 
identify  areas  for  future  audit  efforts. 


Scope  and  Methodology 

Scope.  The  sample  sites  selected  for  review  included  eight  buying 
organizations,  four  gateways,  two  NEPs,  and  eight  VANs.  Specific 
organizations  to  be  visited  for  our  review  were  judgmentally  selected  as  follows: 

o  buying  organizations  certified  as  of  July  1995  and  having  a  high 
volume  of  small  purchases  reported  in  FY  1994, 

o  at  least  one  gateway  from  each  Military  Department, 

o  both  NEPs,  and 

o  both  small  and  large  VANs  based  on  their  responsiveness  to  our 
survey  conducted  in  July  1995. 

At  each  of  the  organizations  visited,  we  conducted  interviews  with  appropriate 
personnel  to  discuss  their  experiences  using  FACNET.  We  solicited  ideas  for 
improvements  to  FACNET.  We  reviewed  files  to  determine  the  number  of 
solicitations,  bids  received,  and  awards  made  using  FACNET.  We  also 
discussed  FACNET  implementation  with  responsible  personnel  at  DISA,  the 
Military  Departments,  and  trading  partners. 

Limitation  to  Review  Scope.  Our  review  was  limited  to  discussions  with 
personnel  regarding  FACNET  implementation  and  documentation  provided 
during  the  discussions.  Therefore,  we  did  not  assess  the  adequacy  of  the 
management  control  program  as  it  applies  to  the  review  objectives.  Ongoing 
and  future  audits  performed  by  the  Inspector  General,  DoD,  will  include  a 
review  of  the  management  control  program. 
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Review  Period,  Standards,  and  Locations.  This  program  review  was 
performed  from  July  through  December  1995  in  accordance  with  auditing 
standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD.  We  did  not  use 
computer-processed  data  or  statistical  sampling  procedures  for  this  audit. 
Enclosure  4  lists  the  organizations  visited  or  contacted. 


Prior  Audits  and  Congressional  Testimonies 

The  Inspector  General,  DoD,  performed  one  audit  concerning  the  audit 
objectives.  In  addition,  the  General  Accounting  Office  has  presented 
testimonies  to  Congress  concerning  the  audit  objectives.  See  Enclosure  3  for 
details  on  prior  audits  and  congressional  testimonies. 


Review  Background 

The  Federal  Acquisition  Streamlining  Act.  The  Federal  Acquisition 
Streamlining  Act  of  1994  authorized  simplified  acquisition  procedures  for 
procurements  up  to  $100,000  and  establishes  a  Government-wide  FACNET. 
FACNET  is  a  communications  network  that  DoD  and  civilian  organizations  are 
using  to  coordinate  EC/EDI  transactions  from  their  individual  buying 
organizations  to  present  a  single  face  to  industry.  A  single  face  to  industry 
means  that  electronic  transactions  are  available  in  the  same  format  regardless  of 
the  Federal  agency  originating  the  transactions.  The  Act  required 
Government-wide  FACNET  capability  to  be  implemented  no  later  than 
January  1,  2000.  The  previous  implementation  deadline  was  January  1997. 

Proposed  revisions  to  the  Federal  Acquisition  Regulation  could  allow  buying 
organizations  to  use  alternative  electronic  commerce  vehicles  such  as  electronic 
bulletin  boards  and  electronic  catalogs.  Specifically,  the  proposed  revisions  to 
the  FAR  state  that  FACNET  should  be  used  where  practicable  and  cost- 
effective. 

In  addition,  the  FY  1996  Authorization  Act  eliminated  the  requirement  for  a 
buying  organization  to  be  FACNET  certified  to  use  simplified  acquisition 
procedures  for  procurements  up  to  $100,000. 

DoD  FACNET  Infrastructure.  The  overall  function  of  the  DoD  FACNET 
infrastructure  (the  Infrastructure)  is  to  provide  widespread  public  notice  of 
contract  opportunities  issued  by  the  Government,  through  privately  owned 
VANs,  and  for  the  Government  to  receive  bids  and  award  contracts  for  supplies 
and  services  through  an  electronic  environment.  The  primary  benefit  of 
FACNET  is  the  sharing  of  a  common  infrastructure  and,  as  a  result,  reducing 
overall  cost  and  access  to  the  widest  collection  of  vendors  who  do  business  with 
the  Government. 

The  Infrastructure  is  composed  of  buying  organizations,  gateways,  NEPs, 
VANs,  and  trading  partners.  Buying  organizations  send  a  transaction  through 
an  application  system  to  the  supporting  gateway.  After  the  gateway  performs 
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translation,  archiving,  and  other  functions,  the  information  is  transmitted  to  a 
NEP.  The  NEP  receives  the  transactions  and  transfers  them  to  VANs  that  have 
been  certified  and  connected  to  the  Infrastructure.  VANs  distribute  the 
information  to  their  trading  partners.  The  trading  partners  return  transactions  to 
the  buying  organization  in  the  reverse  order. 


DISA  is  changing  the  current  Infrastructure  to  combine  the  gateway  and  NEP 
function  into  electronic  commerce  processing  nodes.  DISA  anticipates  that  the 
new  Infrastructure  will  be  fully  implemented  between  September  1996  and 
March  1997. 

DISA  is  responsible  for  the  implementation  of  initial  FACNET  capability 
including  defining,  operating,  and  monitoring  the  performance,  capabilities,  and 
capacity  of  all  portions  of  the  Infrastructure.  DISA  is  also  responsible  for 
providing  day-to-day  system  network  management  and  policies,  procedures,  and 
standards  of  operation. 


Discussion 

The  Federal  Acquisition  Streamlining  Act  of  1994  calls  for  the  creation  of  a 
Government- wide  FACNET  by  January  1997  (later  changed  to 
January  1, 2000).  The  purpose  of  the  network  was  to  automate  the 
labor-intensive,  paper-based  acquisition  system,  to  cut  Federal  procurement 
cost,  to  speed  up  delivery  times,  and  to  increase  procurement  opportunities  for 
small  businesses  with  the  Government.  Although  initiatives  have  been  made  for 
the  full  implementation  of  FACNET,  the  system  has  not  achieved  its  full 
implementation  goal.  Some  of  the  obstacles  hindering  full  implementation  are 
that: 


o  the  "single  face  to  industry"  concept  has  not  been  realized, 

o  the  Infrastructure  has  had  problems  in  adequately  transmitting  data, 

o  FACNET  transactions  are  not  properly  secured  to  ensure  the  validity 
of  transactions  or  the  protection  of  proprietary  information, 

o  vendors  are  not  fully  participating  in  FACNET  implementation, 

o  management  controls  are  not  adequate  for  tracing  FACNET 
transactions,  and 
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o  implementation  plans  were  not  folly  developed  before  FACNET 
inception. 

The  Deputy  Under  Secretary  of  Defense  (Acquisition  Reform)  has  expended 
considerable  effort  with  limited  resources  to  accomplish  the  implementation  of 
FACNET  within  a  short  time  frame.  Problems  are  to  be  expected  when  a  huge 
undertaking  such  as  developing  and  implementing  FACNET  is  required  to  be 
accomplished  quickly.  The  Deputy  Under  Secretary  of  Defense  (Acquisition 
Reform)  needed  time  to  identify  and  clarify  roles  and  responsibilities,  develop 
policy,  and  implement  FACNET.  The  Deputy  Under  Secretary  of  Defense 
(Acquisition  Reform)  is  actively  working  to  address  and  resolve  many  of  the 
issues  identified  that  must  be  addressed  for  the  implementation  of  FACNET  to 
be  successful. 


Single  Face  to  Industry 

According  to  DoD  buying  organizations,  VANs,  and  trading  partners,  the  single 
face  to  industry  is  not  a  reality.  The  primary  goal  of  the  standard  Infrastructure 
is  to  support  a  "single  face  to  industry."  A  single  face  to  industry  means  that 
the  electronic  transactions  must  be  available  in  the  same  format  regardless  of  the 
Federal  agency  originating  the  transaction.  Therefore,  different  automated 
information  systems  employing  dissimilar  technologies  must  issue  transactions 
in  exactly  the  same  manner.  As  a  result,  the  single  face  to  industry  requires 
standardized  data  elements,  transaction  sets,  and  addressing  schemes  to  be  used 
by  Government  agencies.  Also,  the  central  contractor  registry  and  the  VAN 
license  agreement  should  be  standardized  to  present  a  single  face  to  vendors  and 
trading  partners.  Impediments  hindering  the  single  face  concept  include  the 
existence  of  multiple  standards  and  DoD  implementation  conventions. 

Data  Standardization.  In  1979,  the  American  National  Standards 
Institute  chartered  the  Accredited  Standards  Committee  (ASC)  X12  to  develop 
uniform  standards  for  electronic  data  interchange  of  business  transactions.  The 
ASC  X12  is  administered  by  a  nonprofit  organization,  the  Data  Interchange 
Standard  Association.  Each  year,  the  Data  Interchange  Standard  Association 
publishes  the  entire  ASC  X12  standards  in  a  publication  called  a  release. 
Releases  are  draft  standards  used  on  a  trial  basis.  The  purpose  of  the  committee 
publishing  those  releases  is  to  put  current  ASC  X12  approved  draft  standards 
into  the  hands  of  users  on  a  more  frequent  basis.  DoD  and  DISA  have 
approved  the  use  of  multiple  releases  for  FACNET.  This  procedure  can  be 
costly  because  trading  partners  and  VANs  have  to  support  various  releases  of 
the  standards  to  do  business  with  the  Government.  Further,  many  businesses 
feel  that  the  various  standards  available  are  confusing  and  deter  the  single  face 
concept. 

Implementation  Conventions.  The  ASC  X12  standards  are  seldom 
used  in  their  entirety.  For  this  reason,  DoD  has  written  a  series  of 
implementation  conventions,  which  are  subsets  of  ASC  X12  standards.  The 
conventions  describe  the  precise  manner  in  which  DoD  intends  to  use  the 
ASC  XI2  standards  with  its  trading  partners.  VANs  must  enable  interested 
trading  partners  to  receive  and  send  various  DoD  implementation  conventions 
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for  the  ASC  X12  standards.  Some  VANs  expressed  concerns  that  the 
Infrastructure  is  not  assuring  that  transmitted  data  are  in  compliance  with  the 
American  National  Standards  Institute  as  shown  by  the  transmission  to  VANs  of 
noncompliant  transactions.  In  addition,  some  DoD  procurement  offices  are 
creating  their  own  implementation  conventions.  According  to  DISA  personnel, 
the  new  VAN  license  agreement  will  limit  the  standards  allowed  to  be  used  and 
that  should  help  reduce  the  concerns  about  implementation  conventions. 
However,  until  the  existing  various  legacy  systems  that  are  used  to  support 
FACNET  are  upgraded,  the  various  standards  and  implementation  conventions 
will  remain. 


DoD  FACNET  Infrastructure 

The  Infrastructure  has  had  problems  in  adequately  transmitting  data.  The 
Infrastructure  is  the  communications  and  computer  systems  architecture  that 
transmits  procurement  data  from  buying  organizations  to  trading  partners.  The 
primary  goal  of  the  Infrastructure  is  to  support  a  single  face  to  industry  in  the 
most  economical  manner.  DoD  is  still  working  to  implement  the  Infrastructure 
and  resolve  problems  identified.  The  problems  identified  include: 

o  transmission  of  data  through  the  Infrastructure, 

o  responsiveness  to  trouble  tickets, 

o  adequacy  of  the  certification  process  for  VANs  and  buying 
organizations, 

o  usefulness  of  the  central  contractor  registry,  and 

o  accuracy  of  the  number  of  FACNET  transactions  being  reported  to  the 
Deputy  Under  Secretary  of  Defense  (Acquisition  Reform). 

Experiences  With  Data  Transmission.  Buying  organizations  and 
VANs  experienced  problems  with  the  adequate  transmission  of  data  through  the 
Infrastructure.  Bids  were  not  being  transmitted  to  the  buying  organization  in  a 
timely  manner.  Buying  organizations  and  VANs  stated  that  bids  are  submitted 
before  the  closing  dates  on  requests  for  quotes.  However,  connection  problems 
at  the  NEP  may  cause  the  buying  organization  to  receive  bids  after  the  closing 
date.  Also,  VANs  have  reported  that  they  often  review  requests  for  quotes 
from  buying  organizations  late  or  with  a  one-day  response  time  because  of 
gateway  or  NEP  downtime.  In  addition,  the  trading  partners  stated  that  they  do 
not  always  receive  requests  for  quotes,  and  bids  have  gotten  lost. 

Delays  and  Monitoring  Procedures.  Some  of  the  transmission 
problems  may  be  the  result  of  delays  in  data  transmission,  a  lack  of  monitoring 
procedures,  and  the  NEP  having  periods,  which  sometimes  last  for  hours,  when 
it  had  no  connection  to  the  gateway.  For  example,  personnel  at  the 
Mechanicsburg,  Pennsylvania,  gateway  indicated  that  the  gateway  lacked 
monitoring  procedures  for  incoming  transmissions  to  facilitate  notifying 
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DoD  buying  organizations  and  NEPs  when  data  have  not  been  transmitted 
accurately  or  in  a  timely  manner,  or  when  data  have  been  lost  and  need  to  be 
retransmitted. 

DISA  is  working  towards  correcting  the  transmission  problems.  The  new 
Infrastructure,  to  be  implemented  between  September  1996  and  March  1997, 
will  include  system  monitoring  of  incoming  transactions.  According  to  DISA 
personnel,  the  system  monitoring  feature  will  visibly  identify  transmission 
problems  to  the  electronic  commerce  processing  nodes  administrator,  and  as  a 
result  it  will  allow  for  quick  corrective  action. 

Protests.  The  lack  of  gateway  procedures  and  the  lack  of  a 
notification  system  for  transmission  failures  result  in  transactions  transmitted 
late  or  not  transmitted  at  all.  Transmission  failures  because  of  connection, 
procedure,  and  system  problems  could  result  in  trading  partners  filing  protests 
against  the  Government  for  late  and  lost  transactions.  However,  the  number  of 
protests,  to  date,  has  not  been  substantial  in  comparison  to  the  volume  of 
transactions.  Nevertheless,  the  cost  benefit  to  the  Government  is  minimized 
when  the  buying  organization  awards  the  contract  to  a  contractor  who  is  not  the 
lowest  bidder  and  the  lowest  bidder  files  a  protest.  New  electronic  commerce 
processing  nodes  monitoring  procedures  should  help  identify  problems  before 
they  result  in  protests. 

Responsiveness  to  Trouble  Tickets.  Buying  organizations  and  VANs 
were  experiencing  problems  with  the  trouble  ticket  process  put  in  place  to  allow 
FACNET  participants  to  report  problems.  From  June  16  through  November  13, 
1995,  2,163  trouble  tickets  were  reported  to  the  DISA  customer  service  center 
in  Ogden,  Utah.  The  customer  service  center  is  responsible  for  receiving  and 
researching  the  cause  of  reported  transaction  problems.  Buying  organizations 
and  VANs  reported  that: 

o  assistance  was  lacking  for  resolving  trouble  tickets, 

o  the  customer  service  center  closed  trouble  tickets  prematurely,  and 

o  no  feedback  mechanism  existed  for  lost  trouble  tickets  or  to  convey 
resolution  results. 

DoD  buying  organizations  stated  that  they  no  longer  use  the  customer  service 
center  to  resolve  issues  with  transaction  problems  because  of  the  problems 
identified.  DISA  is  attempting  to  address  the  trouble  ticket  problems. 
According  to  DISA,  trouble  tickets  have  been  reduced  to  less  than  7  percent  of 
the  FACNET  transactions.  In  addition,  the  electronic  commerce  processing 
nodes,  the  FACNET  redesign,  will  have  a  system  monitoring  feature  that  will 
help  identify  problem  areas  before  they  result  in  trouble  tickets. 

The  FACNET  redesign  should  reduce  the  systemic  problems  identified  that 
include  an  inability  to  track  transactions  thru  FACNET,  lost  and  late 
transactions,  and  lack  of  acknowledgement  for  the  receipt  of  transactions. 
DISA  is  currently  testing  the  electronic  commerce  processing  nodes  but  DISA 
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has  not  established  milestones  for  their  implementation.  Until  the  electronic 
commerce  processing  nodes  are  in  place,  the  systemic  problems  identified  will 
continue. 

The  redesign  may  not  resolve  all  the  systemic  problems;  However,  such  efforts 
should  both  reduce  the  trouble  ticket  workload  and  improve  user  confidence  in 
FACNET. 


Personnel  Training,  Expertise,  and  Availability.  VANs 
question  the  adequacy  of  training  and  expertise  of  customer  service  center 
personnel  on  technical  issues,  and  they  stated  that  the  personnel  were  not  always 
available  when  needed  because  of  time-zone  differences.  According  to  DISA 
personnel  responsible  for  resolving  trouble  tickets,  DISA  provided  no  training 
on  the  trouble  ticket  process  because  the  process  had  to  be  implemented  so 
quickly. 


Liability  for  Lost  Transactions.  Because  of  problems  with 
trouble  tickets  not  being  adequately  resolved,  a  question  arises  regarding  who  is 
liable  for  lost  transactions  through  the  Infrastructure.  A  large  portion  of 
transaction  problems  reported  by  trouble  tickets  include  lost  transactions. 

In  Inspector  General,  DoD,  Project  No.  5CA-3002.01,  "Audit  of  the  Defense 
Information  System  Agency  Management  of  Trouble  Tickets,"  we  are 
examining  the  effectiveness  of  the  trouble  ticket  process  by  identifying  problem 
areas  that,  if  corrected,  would  result  in  fewer  trouble  tickets.  We  are  also 
evaluating  user  satisfaction  with  corrective  actions  that  DISA  took  on  reported 
problems. 

Certification  Process.  Questions  have  been  raised  on  the  adequacy  of 
the  certification  process  for  VANs  and  buying  organizations.  Before 
transmitting  data  through  the  Infrastructure,  both  VANs  and  buying 
organizations  must  be  FACNET  certified.  As  of  January  1996,  25  VANs  were 
certified  and  14  companies  were  awaiting  certification.  As  of  February  1996, 
227  DoD  buying  organizations  were  FACNET  certified.  This  represents  93 
percent  of  the  potential  244  installations  within  DoD  required  to  implement 
FACNET.  The  227  DoD  buying  organizations  include  Army,  Navy,  and  Air 
Force  organizations.  No  Defense  Logistics  Agency  sites  have  been  certified  as 
of  February  1996.  The  244  installations  also  account  for  80  percent  of  DoD 
small  purchases. 

VAN  Certification.  The  VAN  certification  process  establishes 
the  terms  and  conditions  for  doing  business  with  the  Government.  To 
encourage  VAN  participation  in  FACNET,  certification  requirements  were 
minimal  early  in  the  developmental  stages.  The  VAN  certification  process 
consists  of: 


o  the  VAN  signing  the  VAN  license  agreement, 

o  DISA  reviewing  business  qualifications, 

o  DISA  performing  communications  testing  of  the  VAN,  and 
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o  DISA  signing  the  VAN  license  agreement  after  all  the  previous 
steps  have  been  completed. 

In  Inspector  General,  DoD,  Project  No.  6CA-0019,  "Audit  of  Certification  and 
Management  of  Value-Added  Networks,"  we  are  evaluating  questions  raised, 
both  by  VANs  themselves  and  by  other  FACNET  participants.  Questions  raised 
include  whether  DISA  has  established  an  adequate  Government  VAN 
certification  process  and  whether  DISA  adequately  monitors  and  enforces  the 
VAN  license  agreement.  Preliminary  results  indicate  that  more  than  50  percent 
of  the  certified  VANs  lacked  adequate  financial  resources  and  DISA  was  not 
monitoring  VANs  for  an  internal  quality  monitoring  program,  audit  trails,  and 
disaster  recovery.  In  addition,  VANs  felt  that  the  current  certification  process 
was  not  adequate  to  ensure  that  companies  were  capable  of  handling  the 
transactions  workload  that  would  be  required  for  the  full  implementation  of 
FACNET. 

DISA  is  in  the  process  of  revising  the  VAN  license  agreement  and  plans  to 
incorporate,  under  the  new  VAN  license  agreement,  procedural  changes  that 
should  improve  the  certification  process.  The  revised  VAN  license  agreement 
has  been  released  for  public  comment.  However,  the  potential  for  extensive 
public  comments  could  slow  the  process  for  final  issuance  of  the  revised  VAN 
license  agreement. 

Buying  Organization  Certification.  The  buying  organization 
certification  process  that  DISA  established  ensures  that  organizations  are  capable 
of  transmitting  data  through  the  Infrastructure.  To  be  considered  interim 
FACNET  certified,  a  contracting  office  should  be  able  to: 

o  provide  widespread  public  notice  of  solicitations  for  contract 

opportunities, 

o  receive  responses  to  solicitations  and  associated  requests  for 
information,  and 

o  allow  private  sector  users  to  review  and  respond  to 

solicitations. 

In  Inspector  General,  DoD,  Project  No.  6CA-0013,  "Audit  of  DoD  Interim 
Federal  Acquisition  Computer  Network  Certifications,"  we  are  evaluating 
whether  adequate  tests  are  performed  before  certification  to  ensure  that  buying 
organizations  can  actually  process  FACNET  transactions.  Preliminary  results 
indicate  that  the  DoD  Electronic  Commerce  Office  certified  contracting  offices 
that  were  not  capable  of  sending  and  receiving  FACNET  transactions  because 
the  automated  information  systems  to  which  die  contracting  offices  are  linked 
were  successfully  tested.  For  example,  of  13  contracting  offices  reviewed,  we 
identified  6  contracting  offices  that  were  interim  FACNET  certified  but  were 
not  capable  of  performing  the  requirements  for  interim  FACNET  certification. 
Since  testing  was  limited  to  automated  information  systems,  reliability  of 
FACNET  was  weakened  and  contracting  offices  and  their  trading  partners  may 
be  impacted  by  potential  loss  of  business. 
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Central  Contractor  Registry.  The  purpose  of  the  central  contractor 
registry  is  to  establish  a  data  base  of  all  current  and  potential  Government 
trading  partners.  The  central  contractor  registry  is  to  be  a  central  repository  to 
allow  trading  partners  to  register  once  with  the  Government  instead  of  having  to 
register  with  each  buying  organization.  Use  of  the  central  contractor  registry  is 
not  limited  to  FACNET.  However,  buying  organizations,  VANs,  and  trading 
partners  expressed  concerns  about  the  ability  of  trading  partners  to  become  a 
part  of  the  central  contractor  registry  and  about  the  capabilities  of  the  central 
contractor  registry.  Their  concerns  were  that: 

o  incompatible  software  and  standards  were  used  for  processing 
central  contractor  registry  information,  and 

o  explicitly  defined  roles  and  responsibilities  of  the  central 
contractor  registry  were  lacking. 

VANs  stated  that  procedures  that  are  used  to  include  trading  partners  in  the 
central  contractor  registry  were  not  clear  and  that  a  lack  of  communication 
existed  between  the  VANs  and  DISA  about  the  central  contractor  registry. 
Also,  no  clear  procedure  identifies  who  is  responsible  for  registering  trading 
partners. 

Trading  partner  registration  is  addressed  in  the  current  VAN  license  agreement 
and  is  being  addressed  in  the  proposed  draft  version  of  the  VAN  license 
agreement.  However,  the  charges  of  the  VAN  to  register  trading  partners  may 
discourage  smaller  companies  from  registering.  Also,  VANs  and  trading 
partners  complained  that  the  process  is  too  cumbersome.  The  Deputy  Under 
Secretary  of  Defense  (Acquisition  Reform)  is  addressing  problems  with  the 
central  contractor  registry  and  is  considering  managerial  and  policy  changes. 
Because  of  delays  in  establishing  the  central  contractor  registry,  die  Central 
Contractor  Registry  Financial  Work  Group  requested  that  the  Inspector  General, 
DoD,  conduct  a  systems  review  and  risk  assessment  of  management  controls 
over  the  sufficiency,  integrity,  and  security  of  information  contained  in  the 
central  contractor  registry.  The  issues  include  the  use  of  existing  data  bases  to 
populate  the  central  contractor  registry  and  the  reluctance  of  vendors  to  provide 
proprietary  data  such  as  banking  data  in  the  central  contractor  registry. 

Numbers  Reported  for  FACNET  Transactions.  Army  personnel 
expressed  concerns  about  the  accuracy  of  the  number  of  FACNET  transactions 
reported  to  the  Deputy  Under  Secretary  of  Defense  (Acquisition  Reform). 
According  to  Army  personnel,  the  number  of  FACNET  transactions  being 
reported  include  mainly  functional  acknowledgment  transactions.  Functional 
acknowledgments  indicate  the  receipt  and  acceptance  of  other  transactions  such 
as  requests  for  quotes.  Because  functional  acknowledgments  are  only  a 
confirmation  of  a  FACNET  transmission,  the  Army  feels  that  functional 
acknowledgments  should  not  be  reported  as  actual  FACNET  transactions.  The 
Deputy  Under  Secretary  of  Defense  (Acquisition  Reform)  has  been  directly 
connected  to  the  NEPs  as  of  March  1,  1996,  and  as  a  result,  should  have  valid 
data  for  purposes  of  tracking  transaction  volume  broken  down  by  Military 
Department  and  Defense  agency. 
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Security  Controls 

DoD  needs  to  consider  the  security  of  transactions  and  the  protection  of 
proprietary  information  transmitted  through  the  Infrastructure  in  the  future.  At 
present,  debate  exists  over  the  extent  of  security  measures  needed.  However,  to 
successfully  accomplish  EC/EDI  in  the  future,  Government  agencies  must 
ensure  that  full  consideration  is  given  to  the  risks  inherent  in  the  use  of 
computers  and  telecommunications.  Procurement  transactions  sent  over  the 
Infrastructure  include  sensitive  information  from  trading  partners  that  are 
exposed  to  the  security  risks  inherent  in  transferring  data  through  a  network, 
including  the  security  risks  of  the  Internet.  Without  an  appropriate  level  of 
security,  EC/EDI  operations  may  be  unreliable,  and  loss  of  proprietary 
information  may  be  unnecessarily  high  and  subject  to  compromise.  Security 
issues  that  need  to  be  considered  include  development  of  a  backup  facility,  use 
of  electronic  signature  and  encryption,  and  the  existence  of  audit  trails  for 
management  controls.  As  FACNET  continues  to  grow  and  transaction  values 
increase,  the  security  issues  identified  will  become  even  more  important.  While 
DISA  is  addressing  many  of  the  security  issues,  the  following  should  be  given 
particular  attention. 

Backup  Facility.  Limited  consideration  has  been  given  within  the 
Infrastructure  to  ensure  that  data  backup  and  recovery  are  possible  and  to  reduce 
the  potential  for  loss  of  confidentiality  and  authentication.  Our  review  of  the 
Infrastructure  showed  that  the  system  was  not  adequately  designed  to  eliminate 
lost  or  delayed  transactions  if  the  NEPs  or  gateways  experience  interruption. 
As  the  number  of  transactions  increase,  the  need  becomes  crucial  to  have 
alternate  gateways  and  NEPs  to  prevent  lost  or  delayed  transactions. 
Additionally,  NEPs  and  gateways  would  serve  as  backup  systems  when  the 
primary  system  malfunctions. 

Electronic  Signature.  A  question  has  been  raised  on  whether 
transactions  sent  over  the  Infrastructure  are  valid  without  signatures.  The 
Comptroller  General  has  ruled  that  digital  signatures  can  be  used  instead  of 
handwritten  signatures.  Digital  signatures  by  involved  parties  serve  as  a  means 
to  authenticate  the  terms  of  the  contract  when  transactions  are  paperless.  Digital 
signatures  are  unforgeable,  prove  authenticity,  and  have  the  same  legal  status  as 
a  handwritten  signature. 

The  need  for  digital  signature  capabilities  was  discussed  with  DISA 
management.  DISA  management  did  not  believe  that  such  capabilities  were 
required  for  small  purchases.  In  the  past,  many  transactions  were  concluded 
verbally.  However,  United  States  Code,  title  31,  section  1501,  indicates  that  a 
verbal  agreement  should  be  confirmed  by  a  signed,  written  document,  to  record 
a  valid  obligation.  Though  the  Comptroller  General  ruling  makes  digital 
signatures  optional,  we  believe  that  digital  signatures  should  be  required  to 
provide  evidence  of  a  binding  agreement. 

Encryption.  Trading  partners  need  assurance  that  information  regarded 
as  sensitive,  such  as  quotes  and  proprietaty  data,  are  protected  during  FACNET 
transmission.  Encryption  capabilities  within  the  Infrastructure  would  provide 
trading  partners  with  assurance  that  unclassified  but  sensitive  technical 


11 


information  is  protected.  Encryption  would  convert  bid  information  into  a  code 
readable  only  by  authorized  personnel.  The  American  National  Standards 
Institute  standard  X-12.58,  a  standard  that  defines  data  formats  for  EC/EDI 
transactions,  provides  that  capability;  however,  guidance  has  not  yet  been 
approved  for  DISA  implementation  of  the  American  National  Standards  Institute 
standard  X-12.58  within  FACNET. 

In  Inspector  General,  DoD,  Project  No.  5CA-3003,  "Audit  of  Computer 
Security  for  Electronic  Data  Interchange  and  Electronic  Commerce  Program, " 
we  are  evaluating  procedures  for  data  security,  continuity  of  operations, 
transaction  audit  trails,  personnel  security,  and  compliance  with  network 
security  requirements  specifically  for  small  purchases  made  through  the  EC/EDI 
program.  Also,  the  Office  of  General  Counsel,  DoD,  is  reviewing  legal  issues 
regarding  the  use  of  digital  signatures. 


Vendor  Participation 

As  of  November  1995,  approximately  1,500  out  of  a  potential  200,000  DoD 
trading  partners  were  registered  in  the  central  contractor  registry.  The  small 
number  of  businesses  willing  to  implement  FACNET  may  be  attributable  to  the 
cost  and  lack  of  training.  To  encourage  vendor  participation  in  FACNET,  cost 
should  be  nominal  and  training  should  be  available  and  effective. 

Cost  Investment.  EC/EDI  should  use  technology  that  is  readily 
available  within  most  businesses,  which  would  not  require  a  large  investment  in 
new  capital  resources.  A  survey  of  vendors  indicates  that  they  are  reluctant  to 
implement  FACNET  because  they  feel  that  an  investment  of  $2,150  to  $6,000 
in  hardware,  software,  American  National  Standards  Institute  X12  standards, 
and  VAN  services  is  often  required.  Vendors  are  unable  to  justify  the 
expenditures  involved  with  FACNET  because  the  value  of  the  requests  for 
quotes  going  through  the  Infrastructure,  at  this  point  in  time,  is  not  high.  In 
addition,  trading  partners  must  subscribe  to  a  VAN  that  charges  fees  to  transmit 
requests  for  quotes  and  bids  between  DoD  and  trading  partners.  Vendors  feel 
that  the  VAN  service  fee  structure  is  too  complicated  and  expensive.  According 
to  the  Deputy  Under  Secretary  of  Defense  (Acquisition  Reform),  competitive 
alternatives  to  the  VAN  service  fee  will  be  available  by  September  1996. 

Training.  The  Government  funds  electronic  commerce  training  for 
108  procurement  technical  assistance  centers,  1,100  small  business  regional 
offices,  and  11  electronic  commerce  regional  centers  (funded  totally  by  DoD). 
The  budget  for  the  electronic  commerce  regional  centers  alone  to  provide  free 
electronic  commerce  training  is  $76  million  for  5  years.  Electronic  commerce 
training  is  also  generally  provided  at  cost  by  private  firms  and  educational 
institutions.  The  value  received  by  the  Government  and  by  DoD  in  particular  is 
potentially  less  than  the  cost  spent  on  training.  Trading  partners  and  DoD 
buying  organizations  feel  that  the  training  provided  by  Government  sources  does 
not  address  the  needs  of  the  audience  and  may  be  premature.  Trading  partners 
and  DoD  buying  organizations  also  feel  that  training  efforts  will  be  of  no  value 
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until  technical  problems  with  FACNET  and  electronic  commerce  are  resolved. 
Government  electronic  commerce  training  also  shows  potential  duplication  of 
effort. 

In  Inspector  General,  DoD,  Project  No.  6CA-0002,  "Audit  of  Electronic 
Commerce  Resource  Centers,"  we  are  evaluating  whether  the  program  mission 
of  the  electronic  commerce  resource  centers  are  providing  effective  and 
cost-efficient  training  and  outreach  to  Government  vendors. 


Management  Controls 

Personnel  responsible  for  resolving  FACNET  problems  stated  that  guidance  and 
procedures  are  lacking  on  maintaining  an  audit  trail  for  FACNET  transactions. 
As  a  result,  resolving  trouble  ticket  problems  is  extremely  time-consuming. 
According  to  DISA  personnel,  the  electronic  commerce  processing  nodes,  when 
operational,  will  have  audit  trail  capabilities  and  will  monitor  incoming 
transactions  using  tracking  logs. 

At  present,  FACNET  does  not  have  adequate  management  controls  to  trace 
FACNET  transactions.  An  adequate  audit  trail  does  not  exist  for  transactions 
through  the  Infrastructure  from  DoD  buying  organizations  to  trading  partners. 
For  example,  the  NEP  should  have  audit  capabilities  and  tools  for  analysis  of 
problems  occurring  with  electronic  transactions.  In  addition,  the  VAN  license 
agreement  requires  an  audit  trail  for  transactions  exchanged  through  the  DoD 
mailbox  for  at  least  90  days.  The  lack  of  audit  trails  throughout  the 
Infrastructure  may  prevent  DISA  from  identifying  and  correcting  problems 
occurring  with  electronic  transactions  in  a  timely  manner. 

Further,  management  controls  are  necessary  within  any  process  to  ensure 
compliance  with  procedures  and  to  provide  a  trail  to  trace  questioned 
transactions  and  system  defects.  A  trail  assists  in  the  reviewing  of  records  and 
the  determination  of  accountability.  In  addition,  a  trail  would  assist  personnel 
in  resolving  transaction  problems.  Building  management  controls  and 
traceability  into  the  Infrastructure  is  important  to  ensure  that: 

o  the  Infrastructure  functions  properly, 

o  problems  can  be  traced  and  resolved,  and 

o  personnel  are  held  accountable  for  problems  and  corrective  actions. 


FACNET  Implementation  Plans 

Planning  is  essential  for  the  effective  implementation  of  an  EC/EDI  system. 
Part  of  the  planning  should  include  analyzing  existing  systems  and  testing  the 
system  design  to  ensure  that  it  can  meet  expected  goals.  Because  of  the  urgency 
to  implement  FACNET,  implementation  plans  were  not  fully  developed  before 
FACNET  implementation  in  1995.  Now  participants  in  FACNET  have  raised 
questions  on  whether  restricting  procurement  opportunities  to  FACNET  is 
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prudent  and  whether  alternatives,  including  Internet  and  electronic  bulletin 
boards,  are  more  efficient  and  cost-effective.  The  Deputy  Under  Secretary  of 
Defense  (Acquisition  Reform),  DISA,  Military  Departments,  and  Defense 
agencies  acknowledge  the  rapid  growth  in  technology  and  are  addressing  the 
potential  for  and  impact  of  alternatives  to  FACNET  as  originally  designed. 

Analyzing  Existing  Systems.  Existing  systems,  such  as  the  Internet  and 
electronic  bulletin  boards,  have  certain  capabilities  that  would  improve  or  could 
supplement  FACNET  and  make  FACNET  more  effective.  The  Internet  allows 
vendors  to  make  bid  decisions  without  delays.  Internet  capabilities 
include  timely  availability  of  procurement  information  and  potentially  less 
increased  cost  than  FACNET  because  many  vendors  already  pay  for  Internet 
services.  Electronic  bulletin  boards  are  independently  developed  EC/EDI 
systems.  A  bulletin  board  consists  of  a  computer  equipped  with  a  modem  and 
communication  software  that  enable  procurement  officials  and  vendors  to 
exchange  information  through  telephone  lines.  Procurement  officials  were 
using  bulletin  boards  as  an  interim  means  to  meet  their  procurement 
requirements  until  the  Government-wide  FACNET  becomes  fully  operational. 

The  Director  of  the  DoD  Electronic  Commerce  Office  acknowledges  that  the 
evolution  of  new  technologies  is  creating  alternatives  to  the  original  concept  of 
FACNET  as  the  single  mechanism  for  EC/EDI  procurements.  The  Director 
indicated  that  other  alternatives  were  being  analyzed  that  will  still  maintain  the 
single  face  to  industry.  The  alternatives  are  being  evaluated  in  conjunction  with 
a  series  of  business  decisions  and  evaluations  of  ways  that  DoD  does  business 
and  procurement  as  a  whole. 

Testing  of  DoD  FACNET  Infrastructure.  Some  organizations  were 
concerned  about  whether  FACNET  was  capable  of  handling  the  expected  work 
load  once  full  implementation  occurred.  Currently,  the  Ogden,  Utah,  and 
Columbus,  Ohio,  NEPs  process  15,000  to  20,000  transactions  per  day. 
According  to  DISA,  the  electronic  commerce  processing  nodes  will  be  capable 
of  processing  1.5  million  transactions  per  day.  The  electronic  commerce 
processing  nodes  software  will  be  more  flexible  and  will  also  include  financial 
and  logistics  capabilities.  Concerns  over  the  Infrastructure's  capabilities  might 
be  valid  because  of  the  problems  that  exist  with  the  transmission  of  data  through 
the  Infrastructure  with  a  current  work  load  that  is  substantially  lower  than  die 
full  implementation  of  FACNET.  Adequate  testing  is  not  being  done  before 
implementation,  as  shown  by  the  certification  of  buying  organizations  that  are 
not  capable  of  transmitting  data  through  the  Infrastructure  and  VANs  not  being 
tested  for  compliance  with  the  VAN  license  agreement.  We  have  identified  four 
certified  sites  that  are  not  ready  to  implement  FACNET.  Some  assurance  is 
needed  to  ensure  that  FACNET  is  being  tested  to  meet  expected  goals  for  data 
transmission. 
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Conclusion 


DISA  and  the  DoD  Electronic  Commerce  Office  within  the  Deputy  Under 
Secretary  of  Defense  (Acquisition  Reform)  are  actively  addressing  the  issues 
identified  and  anticipate  being  able  to  successfully  implement  DoD  FACNET 
capabilities  by  January  1,  2000.  EC/EDI  has  already  been  a  success  for  joint 
contracting  centers  in  Bosnia  and  Hungary.  A  temporary  contracting  office  in 
Hungary  uses  EC/EDI  to  locate  and  buy  material  from  U.S.  suppliers  for  fast 
shipment  to  troops  working  the  peacekeeping  mission  in  Bosnia. 

The  Inspector  General,  DoD,  is  currently  conducting  audits  addressing  the 
Infrastructure,  security,  and  vendor  participation.  The  audits  will  be  addressing 
the  validity  of  some  of  the  concerns  identified  during  this  review.  For  the 
objectives  of  the  audits,  see  Enclosure  2.  Because  of  the  ongoing  efforts  by  the 
Deputy  Under  Secretary  of  Defense  (Acquisition  Reform)  and  DISA,  and  the 
ongoing  audits,  this  report  contains  no  recommendations  for  the  issues 
identified. 


Management  Comments  and  Audit  Response 

We  provided  a  draft  of  this  report  to  you  on  March  26,  1996.  Because  this 
report  contains  no  findings  or  recommendations,  comments  were  not  required, 
and  none  were  received.  Therefore,  we  are  publishing  this  report  in  final  form. 
We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Ms.  Kimberley  A.  Caprio,  Audit 
Program  Director,  at  (703)  604-9248  (DSN  664-9248)  (electronic 
mailKCaprio@DODIG.OSD.MIL)  or  Ms.  Carolyn  R.  Milboume,  Audit 
Project  Manager,  at  (703)  604-9214  (DSN  664-9214) 
(electronic  mail  CMilboume@DODIG.OSD.MIL).  Enclosure  5  list  the 
distribution  of  this  report.  The  audit  team  members  are  listed  inside  the  back 
cover. 

Jb'outodL  ft, 

David  K.  Steensma 
Deputy  Assistant  Inspector  General 
for  Auditing 
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Glossary  of  Terms 


Accredited  Standards  Committee  (ASC)  X12.  ASC  X12  develops  the 
structure,  format,  and  content  of  business  transactions  conducted  through  EDI. 

American  National  Standards  Institute.  The  American  National  Standards 
Institute  was  chartered  in  1979  to  develop  uniform  standards  for  electronic 
interchange  of  business  transactions. 

Electronic  Commerce.  Electronic  commerce  integrates  electronic  data 
interchange,  electronic  mail,  electronic  bulletin  boards,  and  internal  automated 
processing  into  a  comprehensive  system  supporting  all  business  functions. 

Electronic  Data  Interchange.  Electronic  data  interchange  exchanges  business 
data  from  computer  to  computer  in  a  standardized  format.  Its  prime  function  is 
to  help  businesses  exchange  data  quickly  and  without  error. 

Federal  Acquisition  Network  (FACNET).  FACNET  is  the  Government- wide 
EC/EDI  systems  architecture  for  acquisition.  FACNET  employs  nationally  and 
internationally  recognized  data  formats  and  provides  universal  user  access.  The 
development  of  FACNET  was  a  requirement  of  the  Federal  Acquisition 
Streamlining  Act  of  1994. 

Gateway.  A  gateway  is  a  system  of  both  hardware  and  software  that  provides 
the  ability  to  electronically  exchange  data  between  computer  applications  using 
ASC  X12  standard  EC/EDI  transactions. 

Network  Entry  Point  (NEP).  A  NEP  is  a  collection  of  hardware  and  software 
that  provides  connectivity  to  commercial  VANs  to  transmit  transactions  between 
DoD  and  its  trading  partners  and  vice  versa. 

Single  Face  to  Industry.  Having  a  single  face  to  industry  is  a  major  objective 
of  implementing  EC/EDI,  through  which  external  trading  partners  receive  the 
electronic  transactions  in  a  similar  and  understandable  manner  regardless  of  the 
product  or  service  to  be  provided. 

Trading  Partner.  A  trading  partner  is  a  customer,  supplier,  or  service 
provider  that  conducts  business  with  a  DoD  organization. 

Value-Added  Network  (VAN).  A  VAN  is  a  commercial  communications 
network  that  provides  a  variety  of  services  that  allow  trading  partners  to  have 
one  procurement  environment. 
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Summary  of  Ongoing  and  Future  Audits 


The  Inspector  General,  DoD,  is  currently  performing  six  audits  covering  issues 
related  to  EC/EDI. 

Inspector  General,  DoD,  Project  No.  6CA-0019,  "Audit  of  Certification  and 
Management  of  Value-Added  Networks,"  began  in  October  1995.  The  audit 
objective  is  to  determine  whether  the  VAN  certification  process  and  the 
management  and  oversight  of  VANs  are  adequate. 

Inspector  General,  DoD,  Project  No.  6CA-0013,  "Audit  of  DoD  Interim 
Federal  Acquisition  Computer  Network  Certifications,"  began  in  October  1995. 
The  overall  audit  objective  is  to  determine  whether  the  process  that  DoD  uses  to 
issue  interim  FACNET  certifications  is  adequate.  The  specific  audit  objectives 
are  to  determine  whether  the  interim  certifications  are  supported  with  required 
documentation  and  whether  organizations  that  have  received  interim  certification 
have  the  required  software  and  are  capable  of  performing  the  FACNET 
transactions. 

Inspector  General,  DoD,  Project  No.  5CA-3003,  "Audit  of  Computer  Security 
for  Electronic  Data  Interchange  and  Electronic  Commerce  Program, "  began  in 
September  1995.  The  audit  objective  is  to  evaluate  the  procedures  for  data 
security,  continuity  of  operations,  transaction  audit  trails,  personnel  security, 
and  compliance  with  network  security  requirements  for  the  EC/EDI  program. 

Inspector  General,  DoD,  Project  No.  6CA-0005,  "Audit  of  Vendor 
Participation  in  Electronic  Commerce,"  began  in  October  1995.  The  audit 
objective  is  to  identify  the  technical  and  business  barriers  to  vendor  use  of 
FACNET  and  to  facilitate  vendors  becoming  FACNET  compliant. 

Inspector  General,  DoD,  Project  No.  6CA-0002,  "Audit  of  Electronic 
Commerce  Resource  Centers,"  began  in  October  1995.  The  overall  audit 
objective  is  to  review  the  management  of  the  electronic  commerce  resource 
centers.  The  specific  objective  is  to  determine  whether  the  electronic  commerce 
resource  centers  program  mission  provided  effective  and  cost-efficient  training 
and  outreach  to  Government  vendors  on  how  to  implement  EC/EDI  and  related 
technologies. 

Inspector  General,  DoD,  Project  No.  5CA-3002.01,  "Audit  of  the  Defense 
Information  System  Agency  Management  of  Trouble  Tickets,"  began 
October  1995.  The  overall  objectives  of  the  audit  were  to  examine  the 
effectiveness  of  the  trouble  ticket  process  and  to  identify  problem  areas  that,  if 
corrected,  would  result  in  fewer  trouble  tickets. 
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Summary  of  Prior  Audits  and  Congressional 
Testimonies 


The  Office  of  the  Inspector  General,  DoD,  issued  a  report  on  electronic  bulletin 
boards.  The  General  Accounting  Office  presented  testimonies  to  the  House 
Committee  on  Small  Business  and  the  Senate  Committee  on  Governmental 
Affairs  and  Armed  Services  concerning  the  audit  objective. 


Inspector  General,  DoD 

Report  Number  96-057,  "DoD  Use  of  Electronic  Bulletin  Boards  in 
Contracting,"  January  8,  1996.  The  objective  was  to  evaluate  the  use  of 
bulletin  boards  by  DoD  organizations  for  contracting  purposes.  The  audit 
determined  that  DoD  procurement  offices  did  not  use  bulletin  boards  to 
circumvent  or  impede  FACNET  implementation.  By  contrast,  procurement 
officials  were  using  bulletin  boards  as  an  interim  means  to  meet  their 
procurement  requirements  until  the  Government-wide  FACNET  was  fully 
operational.  The  report  contained  no  recommendations. 


General  Accounting  Office 

Procurement  Reform.  The  General  Accounting  Office  presented  testimony  on 
"Implementation  of  the  Federal  Acquisition  Streamlining  Act  of  1994"  to  the 
House  Committee  on  Small  Business  on  July  20,  1995.  The  testimony  focused 
on  the  progress  made  with  the  implementation  of  the  Federal  Acquisition 
Streamlining  Act  of  1994.  The  testimony  identified  several  areas  of  FACNET 
that  need  to  be  addressed:  establishment  of  a  well-defined  architecture, 
contractor  registration  with  FACNET,  procurement  opportunities  available 
through  FACNET,  and  services  and  prices  available  through  VANs. 

Government  Reform.  The  General  Accounting  Office  presented  testimony  on 
"Using  Reengineering  and  Technology  to  Improve  Government  Performance"  to 
the  Senate  Committee  on  Governmental  Affairs  on  February  2,  1995.  The 
testimony  focused  on  the  following  areas: 

o  the  critical  risk  in  how  the  Government  is  mismanaging  its  $25  billion 
annual  investment  in  information  technology; 

o  management  practices  used  by  leading  organizations  to  reduce  the 
risks  of  bad  investments  and  increase  the  chances  of  successfully  exploiting 
technology  opportunities;  and 

o  actions  that  executive  agencies  and  Congress  can  take  now  to  bring 
about  a  Government  that  is  smaller,  works  better,  and  cost  less. 
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Organizations  Visited  or  Contacted 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology,  Washington,  DC 
Deputy  Under  Secretary  of  Defense  (Acquisition  Reform),  Washington,  DC 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Research,  Development,  and  Acquisition), 
Washington,  DC 

Headquarters,  U.S.  Army  Medical  Command,  Fort  Sam  Houston,  TX 
Walter  Reed  Army  Medical  Center,  Washington,  DC 
Dwight  David  Eisenhower  Army  Medical  Center,  Fort  Gordon,  GA 
Auditor  General,  Department  of  the  Army,  Washington,  DC 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller), 
Washington,  DC 

Naval  Supply  Command,  Washington,  DC 

Fleet  and  Industrial  Supply  Center,  Norfolk,  VA 
Fleet  and  Industrial  Supply  Center,  Puget  Sound,  WA 
Fleet  and  Industrial  Supply  Center,  San  Diego,  CA 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller), 
Arlington,  VA 

Deputy  Assistant  Secretary  of  the  Air  Force  (Contracting),  Arlington,  VA 
Air  Combat  Command,  Langley  Air  Force  Base,  Hampton,  VA 
6th  Contracting  Squadron,  McDill  Air  Force  Base,  Tampa  Bay,  FL 
Air  Force  Materiel  Command,  Wright-Patterson  Air  Force  Base,  Dayton,  OH 
Air  Force  Development  Test  Center,  Eglin  Air  Force  Base,  Pensacola,  FL 
Maxwell  Air  Force  Base-Gunter  Annex,  Montgomery,  AL 
Air  Mobility  Command,  Scott  Air  Force  Base,  IL 

437th  Military  Airlift  Command,  Charleston  Air  Force  Base,  Charleston,  SC 


Defense  Organizations 

Defense  Information  Systems  Agency,  Arlington,  VA 

Defense  Information  Technology  Contracting  Office,  Scott  Air  Force  Base,  IL 
Defense  Information  Systems  Agency  Western  Hemisphere,  Fort  Ritchie,  MD 
Defense  Megacenter  Columbus,  OH 


II 
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Organizations  Visited  or  Contacted 


Defense  Organizations  (cont'd) 

Defense  Megacenter  Mechanicsburg,  PA 
Defense  Megacenter  Ogden,  UT 
Defense  Logistics  Agency,  Alexandria,  VA 

Defense  General  Supply  Center,  Richmond,  VA 


Non-Defense  Federal  Organization 

General  Accounting  Office,  Washington,  DC 


Non-Government  Organizations 

Advanced  Communication  Systems,  North  Olmsted,  OH 

American  Logistics  Information  Corporation,  Diamond  Bar,  CA 

Advance  Logic  Resources,  Yaphank,  NY 

AT&T,  Philadelphia,  PA 

Datamatix,  Plymouth  Meeting,  PA 

Electronic  Data  Systems,  Herndon,  VA 

ELOCO,  New  Castle,  NH 

GAP  Instrument  Corporation,  Long  Island,  NY 

General  Electric  Information  Systems,  Rockville,  MD 

Harbinger  EDI  Services,  Atlanta,  GA 

MCI  Telecommunications  Corporation,  Piscataway,  NJ 

Network  Information  Services,  Newport  Beach,  CA 

Sidereal  Corporation,  Springfield,  VA 

Simplix,  Troy,  MI 

Softshare  Information  Services,  Santa  Barbara,  CA 
Sprint  Government  Systems  Division,  Overland  Park,  KS 
Sterling  Software,  Dublin,  OH 
Technology  Management  Programs,  Carlsbad,  CA 
Total  Procurement  Services,  Novato,  CA 
TranSettlements,  Inc.,  Atlanta,  GA 
VAN  SAT,  Oklahoma  City,  OK 


ao 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Deputy  Under  Secretary  of  Defense  (Acquisition  Reform) 
Assistant  to  the  Secretary  of  Defense  (Public  Affairs) 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency* 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 


Non-Defense  Federal  Organizations 

Office  of  Management  and  Budget 

Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 
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Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Audit  Team  Members 


This  report  was  prepared  by  the  Contract  Management  Directorate,  Office 
of  the  Assistant  Inspector  General  for  Auditing,  DoD. 

Paul  J.  Granetto 
Kimberley  A.  Caprio 
Addie  M.  Beima 
Carolyn  R.  Milboume 
Kent  E.  Shaw 
Thomas  W.  Smith 
Riccardo  R.  Buglisi 
Johnetta  R.  Colbert 
Young  J.  Jin 
Veronica  G.  McCain 
James  A.  Wingate 
Dahnelle  A.  Alexander 
Robert  E.  Beets 
William  C.  Coker 
Lisa  A.  Dean 
Dorothy  L.  Dixon 
Awanda  A.  Grimes 
Rhonda  K.  Mead 
Todd  A.  Sutton 
Adam  S.  Weissberg 
Tara  L.  Queen 
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